Davidfcarr Quick Playground vulnerabilities

CVE-2026-1830 [CRITICAL] CWE-862 CVE-2026-1830: The Quick Playground plugin for WordPress is vulnerable to Remote Code Execution in all versions up The Quick Playground plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.1. This is due to insufficient authorization checks on REST API endpoints that expose a sync code and allow arbitrary file uploads. This makes it possible for unauthenticated attackers to retrieve the sync code, upload PHP files

CVE-2026-6403 [HIGH] CWE-22 CVE-2026-6403: The Quick Playground plugin for WordPress is vulnerable to Path Traversal in versions up to and incl The Quick Playground plugin for WordPress is vulnerable to Path Traversal in versions up to and including 1.3.3. This is due to insufficient path validation in the qckply_zip_theme() function, which appends a user-controlled 'stylesheet' parameter directly to the theme root directory path without sanitizing directory traversal sequences. This makes it po

CVE-2026-2500 [MEDIUM] CWE-22 CVE-2026-2500: The Quick Playground plugin for WordPress is vulnerable to Path Traversal in all versions up to, and The Quick Playground plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.4. This is due to the `qckply_data()` function passing the user-supplied `filename` POST parameter directly to `file_get_contents()` without any validation, sanitization, or path restriction. This makes it possible for authenticated attac